CVE-2015-3439

Status: ModifiedMedium (4.3)—

Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as.

CVSS

Version: 2.0
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Base score: 4.3

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 5.08%
Percentile among all scored CVEs: 92
Score date: 10/8/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (2)

Debian — Debian Linux Wordpress — Wordpress

CWEs

CWE-79

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2015-3439",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "security@debian.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-08-05T10:59:00.263",
  "references": [
    {
      "url": "http://codex.wordpress.org/Version_4.1.2",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.html",
      "source": "security@debian.org"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html",
      "source": "security@debian.org"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.debian.org/security/2015/dsa-3250",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/74269",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1032207",
      "source": "security@debian.org"
    },
    {
      "url": "http://zoczus.blogspot.com/2015/04/plupload-same-origin-method-execution.html",
      "tags": [
        "Exploit"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "https://core.trac.wordpress.org/changeset/32168",
      "source": "security@debian.org"
    },
    {
      "url": "https://wordpress.org/news/2015/04/wordpress-4-1-2/",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "https://wpvulndb.com/vulnerabilities/7933",
      "source": "security@debian.org"
    },
    {
      "url": "http://codex.wordpress.org/Version_4.1.2",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2015/dsa-3250",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/74269",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1032207",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://zoczus.blogspot.com/2015/04/plupload-same-origin-method-execution.html",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://core.trac.wordpress.org/changeset/32168",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wordpress.org/news/2015/04/wordpress-4-1-2/",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wpvulndb.com/vulnerabilities/7933",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de XSS en el shim Ephox (anteriormente Moxiecode) plupload.flash.swf 2.1.2 en Plupload, tal como se utiliza en WordPress 3.9.x, 4.0.x y 4.1.x en versiones anteriores a 4.1.2 y otros productos, permite a atacantes remotos ejecutar funciones JavaScript del mismo origen a través del parámetro target, según lo demostrado ejecutando cierta función de clic, relacionada con _init.as y _fireEvents.as."
    }
  ],
  "lastModified": "2026-06-17T00:25:55.870",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:3.9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB4D4609-5AD6-44F3-B991-74E35A7E5C2D"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:3.9.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B79DE40E-BFA7-43DA-AB42-2812FB207941"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:3.9.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EED9381-2BFC-4BDA-AC4B-CBC77E8538D4"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:3.9.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D0FDD6C2-CD33-4812-9962-3BE73D450C33"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E372A3D2-FCB5-4A74-840D-EC03732FCC97"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:4.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22427650-230D-4CB0-BACC-723B9B2CDC31"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "18F20563-46BB-4E5C-BEF5-122A32C76261"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:4.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74AF56DD-82D6-4100-B82C-536C46358B07"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@debian.org"
}